Certified Information Privacy Professional – Europe (CIPP/E) — Question 64

SCENARIO -
Please use the following to answer the next question:
BHealthy, a company based in Italy, is ready to launch a new line of natural products, with a focus on sunscreen. The last step prior to product launch is for BHealthy to conduct research to decide how extensively to market its new line of sunscreens across Europe. To do so, BHealthy teamed up with Natural Insight, a company specializing in determining pricing for natural products. BHealthy decided to share its existing customer information – name, location, and prior purchase history – with Natural Insight. Natural Insight intends to use this information to train its algorithm to help determine the price point at which BHealthy can sell its new sunscreens.
Prior to sharing its customer list, BHealthy conducted a review of Natural Insight’s security practices and concluded that the company has sufficient security measures to protect the contact information. Additionally, BHealthy’s data processing contractual terms with Natural Insight require continued implementation of technical and organization measures. Also indicated in the contract are restrictions on use of the data provided by BHealthy for any purpose beyond provision of the services, which include use of the data for continued improvement of Natural Insight’s machine learning algorithms.
What is the nature of BHealthy and Natural Insight’s relationship?

Answer options

• A. Natural Insight is BHealthy’s processor because the companies entered into data processing terms.
• B. Natural Insight is BHealthy’s processor because BHealthy is sharing its customer information with Natural Insight.
• C. Natural Insight is the controller because it determines the security measures to implement to protect data it processes; BHealthy is a co-controller because it engaged Natural Insight to determine pricing for the new sunscreens.
• D. Natural Insight is a controller because it is separately determining the purpose of processing when it uses BHealthy’s customer information to improve its machine learning algorithms.

Correct answer: D

Explanation

The correct answer is D because Natural Insight independently determines how to process BHealthy’s customer information for its own purposes, specifically to enhance its machine learning algorithms. Options A and B are incorrect because BHealthy is not merely sharing data; it has contractual terms that limit Natural Insight's use of that data. Option C is inaccurate as BHealthy does not share control over the data use, given the restrictions outlined in the contract.